CVE-2026-60408 affects Oracle TimesTen In-Memory Database, specifically version 26.1.1.1.0, within the Kubernetes Operator component. The vulnerability allows a low privileged attacker with network access over HTTPS to compromise the database and gain unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector with confidentiality impact only. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not provide explicit patch or remediation details for it. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability results in unauthorized read access to some data within the TimesTen In-Memory Database. This compromises confidentiality but does not affect data integrity or availability. The attacker requires network access via HTTPS and low privileges, indicating a moderate risk level. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and staying on actively supported versions. Until a patch is released, consider restricting network access to the TimesTen In-Memory Database Kubernetes Operator component to trusted sources only.